CVE-2026-115363

A flaw was found in OpenBao. When External Account Binding EAB is configured with the Automatic Certificate Management Environment ACME to manage certificates, the sanitized configuration endpoint fails to redact the EAB Message Authentication Code MAC key. An authenticated user with permission t...

CVE-2026-74759

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

CVE-2026-74759 Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

CVE-2026-74759

The Google::Auth Perl library (version 0.12 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Google::Auth::ExternalAccountCredentials::Aws class. The flaw exists because the retrieve_subject_token method sends requests to the imdsv2_session_token_url, url, and region_url f...

EUVD-2026-114873

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

CVE-2026-74759: Server-Side Request Forgery (SSRF)

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credentialsource URLs in AWS external account credentials. An externalaccount configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrievesubjecttoken sends...

PT-2026-134918

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential source URLs in AWS external account credentials. An external account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve subject token sen...

BIT-OPENBAO-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tlsacmeeabmackey value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used f...

PT-2026-132455

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls acme eab mac key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key us...

CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

EUVD-2026-108972

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

PT-2026-122094

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tlsacmeeabmackey value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used f...

CVE-2026-114474

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...

CVE-2026-114474

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Use of Less Trusted Source (CWE-348) issue during external-account downloads. When the server downloads messages from external POP3 or IMAP accounts, it fails to generate a proper SMTP envelope, instead using the addre...

EUVD-2026-107317

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...

CVE-2026-114474 Use of Less Trusted Source in hMailServer

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...

CVE-2026-114474 Use of Less Trusted Source in hMailServer

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...

CVE-2026-114474 Use of Less Trusted Source in hMailServer

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...

PT-2026-120652

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...